Re: security framework for XML-LibXSLT [fwd]

Sorry, this post was intended for a different list.

-- Petr

On Friday 06 October 2006 10:02, Petr Pajas wrote:
> Hi,
>
> I thought someone might be interested. Shane Corgatelli contributed a
> security framework to XML::LibXSLT. Currently you may find his patch
> applied to SubVersion (svn co svn://axkit.org/XML-LibXSLT/trunk) and it
> will eventually appear in 1.62. Shane's description and the relevant
> section from POD follows.
>
>   Petr
>
> >From http://rt.cpan.org/Ticket/Display.html?id=21887
> >
> > I've created a patch that adds an interface to the libxslt security
> > framework. It introduces a new class 'XML::LibXSLT::Security' that has a
> > similar interface to XML::LibXML::InputCallback.
> >
> > It allows the user to create callback functions for each of the libxslt
> > security preferences. Currently the security preferences are only
> > applied to the transform context and are only available at runtime. I
> > believe it is thread safe, but have not explicitly tested this.
> >
> > The patch file (against 1.61) is attached.
> >
> > Hope this is useful,
> >
> > Shane Corgatelli
> > EZ-NetTools
>
> ---------
>
> >From LibXSLT documentation:
>
> XML::LibXSLT::Security
>     Provides an interface to the libxslt security framework by allowing
>     callbacks to be defined that can restrict access to various resources
>     (files or URLs) during a transformation.
>
>     The libxslt security framework allows callbacks to be defined for
>     certain actions that a stylesheet may attempt during a transformation.
>     It may be desirable to restrict some of these actions (for example,
>     writing a new file using exsl:document). The actions that may be
>     restricted are:
>
>     read_file
>         Called when the stylesheet attempts to open a local file (ie: when
>         using the document() function).
>
>     write_file
>         Called when an attempt is made to write a local file (ie: when
> using the exsl:document element).
>
>     create_dir
>         Called when a directory needs to be created in order to write a
>         file.
>
>         NOTE: By default, create_dir is not allowed. To enable it a
> callback must be registered.
>
>     read_net
>         Called when the stylesheet attempts to read from the network.
>
>     write_net
>         Called when the stylesheet attempts to write to the network.
>
>   Using XML::LibXSLT::Security
>     The interface for this module is similar to XML::LibXML::InputCallback.
>     After creating a new instance you may register callbacks for each of
> the security options listed above. Then you apply the security preferences
> to the XML::LibXSLT or XML::LibXSLT::Stylesheet object using
>     "security_callbacks()".
>
>       my $security = XML::LibXSLT::Security->new();
>       $security->register_callback( read_file  => $read_cb );
>       $security->register_callback( write_file => $write_cb );
>       $security->register_callback( create_dir => $create_cb );
>       $security->register_callback( read_net   => $read_net_cb );
>       $security->register_callback( write_net  => $write_net_cb );
>
>       $xslt->security_callbacks( $security );
>        -OR-
>       $stylesheet->security_callbacks( $security );
>
>     The registered callback functions are called when access to a resource
>     is requested. If the access should be allowed the callback should
> return 1, if not it should return 0. The callback functions should accept
> the following arguments:
>
>     $tctxt
>         This is the transform context (XML::LibXSLT::TransformContext). You
>         can use this to get the current XML::LibXSLT::Stylesheet object by
>         calling "stylesheet()".
>
>           my $stylesheet = $tctxt->stylesheet();
>
>         The stylesheet object can then be used to share contextual
>         information between different calls to the security callbacks.
>
>     $value
>         This is the name of the resource (file or URI) that has been
>         requested.
>
>     If a particular option (except for "create_dir") doesn't have a
>     registered callback, then the stylesheet will have full access for that
>     action.
>
>   Interface
>    new()
>     Creates a new XML::LIbXSLT::Security object.
>
>    register_callback( $option, $callback )
>     Registers a callback function for the given security option (listed
>     above).
>
>    unregister_callback( $option )
>     Removes the callback for the given option. This has the effect of
>     allowing all access for the given option (except for "create_dir").
>
>
> --++**==--++**==--++**==--++**==--++**==--++**==--++**==
> ptk mailing list
> [email protected]
> https://mailman.stanford.edu/mailman/listinfo/ptk
--++**==--++**==--++**==--++**==--++**==--++**==--++**==
ptk mailing list
[email protected]
https://mailman.stanford.edu/mailman/listinfo/ptk